Authentication

Every catalog API call carries the connection's API key in the X-Api-Key header.

curl https://api.pluswase.com/api/v1/store \
  -H "X-Api-Key: plw_live_…"

The key belongs to one connection, so it reads only what is published to that site. There is no other kind of key in this version.

Keep the key on the server. Call the API from PHP (the plugin's plw_api_get() does it for you), never from JavaScript that runs in a shopper's browser. Anyone with the key can read the store's catalog and send orders.

Optional headers

The plugin sends these on every call; PlusWase shows them on the connection page and uses them for the Connect checks. Other clients may leave them out.

Header	Value
`X-PLW-Plugin`	The PlusWase Hub version, such as `0.2.0`.
`X-PLW-WC`	The WooCommerce version.
`X-PLW-Currency`	The store currency; it must be `USD` to connect.
`X-PLW-Site`	The site's address (`home_url()`).

Limits

600 requests per minute per connection. Over the limit the answer is 429 with Retry-After: 60.
Request bodies (order pushes) are limited to 1 MB.
Cache catalog answers. The plugin keeps each one for 30 minutes and a stale copy for 24 hours, which it serves when PlusWase cannot be reached.

Errors

Errors are JSON with one error field.

{ "error": "Invalid or missing API key." }

Status	Meaning
`400`	The request is malformed (for example a push without JSON).
`401`	The key is missing, wrong, revoked or deleted.
`404`	The product, collection, brand or tag is not published to this site.
`422`	A push was refused (an unknown variant, a number not reserved by this site, a currency other than USD).
`429`	Too many requests; wait for `Retry-After`.
`500`, `503`	PlusWase had a problem; retry later and serve what you cached.